臺灣博碩士論文加值系統

隨著網路的快速發展，經由網路所提供的各種服務日益增加，服務使用的便利性也隨之增加，但相對的當這些服務遭遇由網路而來的攻擊而受到損害時其影響與不便也日益嚴重。電腦蠕蟲是一種具備自我複製與自動傳播功能的軟體型態，由於其傳播過程隱密且影響範圍廣泛，近來運用它進行的網路攻擊的事件接連發生，所造成的損害也持續擴大，要如何在遭遇蠕蟲攻擊時降低個別網路環境中系統受損的情況是現在重要的研究課題。 現有的蠕蟲偵測或防禦的系統著眼在即時發現所有的蠕蟲攻擊，然而與網際網路連接為數眾多的小型組織與個人網路大多無法提供其所需要使用的大量資源。 在本論文中我們嘗試提供一個可行的方案，使得小環境以及個別使用者能夠運用少量的資源即可進行對蠕蟲攻擊的自我防禦，我們分析探討蠕蟲的特有行為、感染方式與躲避偵測的方法，並探討現有的蠕蟲偵測系統所適用的地方以及其在整體蠕蟲防禦工作上的不足性。 據此，我們發展了一套以誘補系統為基礎的輕量化蠕蟲偵測保護系統，透過簡易的客製化的過程，可以針對個別的系統製作特定的保護措施，以減少額外且不需要的資源浪費，並且解決傳統在弱點發佈後至修正程式公佈期間的空窗期間使用者對攻擊無抵抗能力的缺憾。 最後我們利用真實網路環境下的流量以及真實的蠕蟲攻擊來驗證我們的系統，並且從中分析我們系統發出警報時的可靠度及產生的特徵與蠕蟲本體的相似度，並分析系統需要改進的地方。

As the Internet prevails, the number of services provided through the Internet increases everyday. On one hand, it improves the convenience in utilizing the services. On the other hand, when these services encounter attacks from the Internet and are compromised, the inconvenience and the resulted influence become hard to tolerate. Computer worm is a type of software with the built-in capabilities of self-replication and automatic propagation. It can propagate without being noticed and to a large extend. Recently, network attacks based on computer worms occurred one after another. And, the damages they made grow rocketing high. How to reduce the damage of individual network environment on encountering computer worm attacks has become a very important research issue. Current worm detection or defense system requires heavy resources that the many Internet-connecting network environments owned by small organizations or individuals are unable to offer. In this study, we tried to provide a legitimate solution which allows small organizations on individuals to defend themselves with small amount of resources. By analyzing the behaviors of computer worms, the method they propagate and they way they use to avoid being detected as well as surveying the applicability and insufficiency of current worm detection schemes, we developed a honey-pot based light-weight worm defense system. With an easily accomplishable configuration process, users are able to customize the defense system to their needs. The proposed system has been tested against real Internet traffic and computer worms. The effectiveness of the proposed system has been studied.

目次
摘要 i
Abstract iii
誌謝 v
圖目錄 viii
第一章、前言 1
1.1 背景 1
1.2 研究動機 4
1.3 研究發展方向 5
1.4 論文架構 6
第二章、相關工作 7
2.1 利用大量IP空間提高蠕蟲進入機率與數量 7
2.2 以大量封包流量分析或是 監控大規模網域中的異常行為 9
2.2.1 硬體即時分析廣域流量偵測蠕蟲特徵的系統 10
2.2.2 分析進出封包配對找出已感染主機 11
2.3 利用封包的特徵值比對 13
2.3.1 利用蠕蟲攻擊來源與目的端的服務關聯性 14
2.3.2 利用誘騙系統產生封包特徵 15
2.4 各系統的適用情形 17
第三章、以誘騙系統為基礎所 設計的蠕蟲偵測系統 18
3.1 誘騙系統的特性與應用 18
3.2 蠕蟲的基本行為以及偵測方法 20
3.3 特徵產生與比對 22
3.4 適用於小型網路之蠕蟲偵測保護系統 23
3.4.1 系統實作 25
3.4.2 系統運作流程 27
3.5 系統的適用性與相關討論 28
第四章、實驗與分析 31
4.1 系統有效運作的驗證 31
4.1.1 影響系統作用的因素 31
4.1.2 實驗目標 33
4.2 實驗環境與設定 34
4.3 實驗結果與分析 36
第五章、結論討論與未來工作 39
參考文獻 40
附錄一 數種系統偵測效率的討論 42
附錄二 LCS演算法 45
附錄三 防火牆策略 48

圖目錄
圖1.1：蠕蟲攻擊周期 2
圖2.1：封包進入至警報產生的運作步驟 10
圖2.2：Malware Warning Center的系統架構 12
圖2.3：HoneyComb的封包串接比較 16
圖3.1：系統架構圖 24
圖3.2：系統流程圖 27

[1]D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, &N. Weaver(2003). Inside the slammer worm. IEEE Security and Privacy, 1(4), 33-39.
[2]http://www.caida.org/publications/papers/2003/sapphire/sapphire.html
[3]D. Dagon, X. Qin, G. Gu, W. Lee, J. Grizzard, J. Levine, &H. Owen (2004). HoneyStat: LocalWorm detection using honeypots. 2004 7th International Symposium, RAID 2004, Sophia Antipolis, France, 39-58.
[4]http://www.honeynet.org/
[5]http://www.cert.org.tw/document/column/show.php?key=42
[6]S. Staniford, D. Moore, V. Paxson, &N. Weaver (2004). The top speed of flash worms. 2004 ACM Workshop On Rapid Malcode (WORM), 33-42.
[7]Cliff C. Zou, D. Towsley, W. Gong, &S. Cai (2005). Routing worm: A fast, selective attack worm based on IP address information. ACM 19th Workshop on Principles of Advanced and Distributed Simulation, 199-206.
[8]B. Madhusudan, &J. Lockwood (2004). Design of a system for real-time worm detection. Hot Interconnects, Stanford, CA , 77–83.
[9]C. C. Zou, L. Gao, W. Gong, &D. Towsley(2003). Monitoring and early warning for internet worms. 2003 10th ACM Conference on Computer and Communications Security, 190-199.
[10]http://www.cs.unc.edu/~welch/kalman/#Anchor-48213
[11]Guofei Gu, M. Sharif, Xinzhou Qin, D. Dagon, W. Lee, &G. Riley (2004). Worm detection, early warning and response based on local victim information. IEEE Computer Security Applications Conference, 2004, 20th Annual, 136-145.
[12]Christian Kreibich, &Jon Crowcroft (2004). Honeycomb: Creating intrusion detection signatures using honeypots. 2004 ACM SIGCOMM Computer Communication Review archive, 34(1) , 51-56.
[13]http://www-igm.univ-mlv.fr/~lecroq/seqcomp/node4.html
[14]http://www.tcpdump.org/
[15]http://www.netfilter.org/